Kerberos replay attack within allowed range - authenticator won't prevent it?

Question

In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request.

What if an attacker performs a replay attack within the allowed clock skew, so that the difference between the timestamp in the authenticator the attacker copied and the TGS's clock is still allowed. What kind of check will the TGS perform in such a case ?

If the clock skew is 5 minutes then shouldn't there be some cache memory holding all requests from the last 5 minutes so that if the same authenticator arrives again TGS will reject it since the same timestamp already exists in its cache ? (because a valid client sending a second request would generate a new timestamp while an attacker will use an existing timestamp) ?

Is there such a cache for the case of a replay attack within the allowed time range ?

Answer 1

In Kerberos V5 a replay cache was introduced which keeps track of all authenticators recently presented to a service (recently = the size of the clock skew). If a duplicate authentication request is detected in the replay cache, an error message is sent to the application program.